syzbot
kernel BUG in jffs2_sum_write_sumnode
Status:
upstream: reported on 2026/08/15 05:15
Reported-by: syzbot+48f2d47f83a4c223ad14@syzkaller.appspotmail.com
First crash: 2d16h, last: 2d16h
Sample crash report:
jffs2: warning: (11471) jffs2_sum_write_sumnode: Empty summary info!!!
------------[ cut here ]------------
kernel BUG at fs/jffs2/summary.c:868!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 11471 Comm: jffs2_gcd_mtd0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : jffs2_sum_write_sumnode+0x1bcc/0x1bd8 fs/jffs2/summary.c:867
lr : jffs2_sum_write_sumnode+0x1bcc/0x1bd8 fs/jffs2/summary.c:867
sp : ffff800021ad7480
x29: ffff800021ad75c0 x28: ffff0000dff34000 x27: 0000000000001008
x26: 0000000000000ff4 x25: ffff0000dff36120 x24: ffff0000f521a900
x23: ffff0000dff345a8 x22: ffff800021ad74e0 x21: 0000000000000000
x20: ffff0000f45b8570 x19: dfff800000000000 x18: 1fffe00033e7277e
x17: ffff80001537d000 x16: ffff800011b90080 x15: 0000000040000000
x14: 0000000000000001 x13: 1ffff0000435adf8 x12: 0000000000000000
x11: ff00800008315484 x10: 0000000000000000 x9 : 32ce504b55419300
x8 : 32ce504b55419300 x7 : ffff80000825ab50 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff80000a927f5c
x2 : ffff00019f393d10 x1 : 0000000100000000 x0 : 0000000000000046
Call trace:
jffs2_sum_write_sumnode+0x1bcc/0x1bd8 fs/jffs2/summary.c:867
jffs2_do_reserve_space+0x150/0xd5c fs/jffs2/nodemgmt.c:388
jffs2_reserve_space_gc+0x60/0xfc fs/jffs2/nodemgmt.c:222
jffs2_garbage_collect_pristine+0xf4/0xb9c fs/jffs2/gc.c:613
jffs2_garbage_collect_live+0x570/0x2950 fs/jffs2/gc.c:546
jffs2_garbage_collect_pass+0x1440/0x1a68 fs/jffs2/gc.c:464
jffs2_garbage_collect_thread+0x3dc/0x44c fs/jffs2/background.c:155
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: 913e8000 d005b522 9127bc42 97a562c9 (d4210000)
---[ end trace 0000000000000000 ]---
* Struck through repros no longer work on HEAD.